CSharpTools

Collection of useful C# Tools for offensive assessments.

Execution (TA0002)

SharpShooter Payload Generation Framework.

Persistence (TA0003)

SharpStay .NET project for installing Persistence.

Privilege Escalation (TA0004)

SharpUp C# port of various PowerUp functionality.

Watson Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities.

Defence Evasion (TA0005)

RemoteProcessInjection C# remote process injection utility for Cobalt Strike.

SharpeningCobaltStrike In realtime v3.5/4.0 dotnet compiler for your linux Cobalt Strike C2. New fresh compiled and obfuscated binary for each use.

SharpCompile SharpCompile is an Aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.

BlockETW .Net 3.5 / 4.5 Assembly to block ETW telemetry in a process.

Credential Access (TA0006)

SharpWeb Retrieve saved logins from Google Chrome, Firefox, Internet Explorer and Microsoft Edge.

SharpDump C# port of PowerSploit's Out-Minidump.ps1 functionality.

Rubeus C# toolset for raw Kerberos interaction and abuses.

SharpRoast C# port of various PowerView's Kerberoasting functionality.

SharpDPAPI C# port of some Mimikatz DPAPI functionality.

SafetyKatz Slightly modified version of the Mimikatz project.

Net-GPPPassword .NET implementation of Get-GPPPassword.

Internal-Monologue Retrieving NTLM Hashes without Touching LSASS.

Discovery (TA0007)

SharpView C# implementation of harmj0y's PowerView.

Seatbelt Host-survey "safety checks" relevant from both offensive and defensive security perspectives.

SharpHound C# Rewrite of the BloodHound Ingestor.

SauronEye Search tool built to aid red teams in finding files containing specific keywords.

Lateral Movement (TA0008)

SharpWMI C# implementation of various WMI functionality.

SharpRDP Remote Desktop Protocol .NET Console Application for Authenticated Command Execution.

SharpRDPCheck Use to check the valid account of the Remote Desktop Protocol (Supports plaintext and NTLM hash).

SharpMove .NET Project for performing Authenticated Remote Execution.

Collection (TA0009)

WireTap .NET 4.0 Project to interact with video, audio and keyboard hardware.

Command and Control (TA0011)

SharpC2 .NET C2 Framework Proof of Concept.

Exfiltration (TA0010)

MiddleOut A small .NET compression utility.

Other Collections

RedTeamCSharpScripts C# Scripts used for Red Team Assessments.

OffensiveCSharp Collection of Offensive C# Tooling.

HastySeries ObscurityLabs RedTeam C# Toolkit.

cobalt_strike_extension_kit Tired of typing execute-assembly everytime you use Cobalt Strike? Clone this.